OM-SEC-14: Run update hooks without reusable sudo authority

default/agents/skills/omarchy/hooks.md

@@ -14,8 +14,8 @@ file first, if one exists.
 ├── battery-low.d/          # Low battery (percentage in $1)
 ├── font-set.d/             # After font change (font name in $1)
 ├── post-boot.d/            # After the desktop starts
-├── post-update.d/          # During `omarchy update`, after system packages and migrations
-├── pre-refresh-pacman.d/   # Before `omarchy refresh pacman` re-syncs packages
+├── post-update.d/          # At the end of `omarchy update`, after privileged work
+├── pre-refresh-pacman.d/   # After `omarchy refresh pacman` finishes (legacy name)
 └── theme-set.d/            # After theme change (theme slug in $1)
 ```
 
@@ -26,3 +26,5 @@ THEME_NAME=$1
 echo "Theme changed to: $THEME_NAME"
 # Add custom actions here
 ```
+
+Update-related hooks run only after the workflow's privileged work and after Omarchy invalidates its sudo timestamp. A hook that invokes `sudo` must therefore request its own explicit authorization. The legacy-named `pre-refresh-pacman` hook runs after the refresh transaction; during `omarchy channel set`, it is deferred further until the package switch and complete update finish. Executable user code cannot safely run before a later sudo authentication because a detached child could wait for the new timestamp.

default/omarchy/sudo-no-update/sudo

@@ -0,0 +1,27 @@
+#!/bin/bash -p
+
+# Internal update/migration sudo boundary. Authentication may authorize this
+# command, but -N prevents it from publishing a timestamp that detached user
+# code can silently reuse.
+
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup for the sudo boundary." >&2
+  exit 126
+fi
+
+require_privileged_bash_startup() {
+  [[ $- == *p* ]] || return 1
+  /usr/bin/env -i /usr/bin/bash -p -c '
+    [[ $1 =~ ^[1-9][0-9]*$ ]] || exit 1
+    mapfile -d "" -t argv <"/proc/$1/cmdline" || exit 1
+    executable=$(/usr/bin/readlink -e -- "/proc/$1/exe") || exit 1
+    [[ $executable == /usr/bin/bash ]]
+    [[ ${argv[0]:-} == /bin/bash || ${argv[0]:-} == /usr/bin/bash ]]
+    [[ ${argv[1]:-} == -p ]]
+  ' omarchy-bash-startup "$$"
+}
+if ! require_privileged_bash_startup; then
+  echo "Refusing an unsafe Bash startup for the sudo boundary." >&2
+  exit 126
+fi
+exec /usr/bin/sudo -N -- "$@"